Static task
static1
General
-
Target
78275e4417b09ce4db13ab4170583541aee026cc06e8baff730eb34461633785
-
Size
288KB
-
MD5
91269f725702fdd5b742244a7e8be1ea
-
SHA1
9f7681c0365032b14f68aeab822a0464ff0764ae
-
SHA256
78275e4417b09ce4db13ab4170583541aee026cc06e8baff730eb34461633785
-
SHA512
7e2020d94da84d405bc8bd0578d085c5ab3fa20e8ad0a9bff739d89dd3d99da56b075e70a68b6e2e09e3aaa56782f4e8946ae1320e66f052136ebd6258fc9e74
-
SSDEEP
3072:iGeYPPVn71aKOrBuE9Xx/C/g1ZXSQFoXFDGQVfNZX1y95Nlvo5l17THK5jjuwr+J:iCln7JOrUqhnXSOoXFDDVr1Wlvo6+Jd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 78275e4417b09ce4db13ab4170583541aee026cc06e8baff730eb34461633785
Files
-
78275e4417b09ce4db13ab4170583541aee026cc06e8baff730eb34461633785.sys windows:6 windows x64
18eaa0ff4ab9705734ccb047d2b5f1bb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntoskrnl.exe
ZwOpenKey
PsGetCurrentProcessId
PsSetLoadImageNotifyRoutine
PsSetCreateProcessNotifyRoutine
PsRemoveLoadImageNotifyRoutine
ExpInterlockedPushEntrySList
ExpInterlockedPopEntrySList
ExDeletePagedLookasideList
ExQueryDepthSList
ExInitializePagedLookasideList
KeSetEvent
KeWaitForSingleObject
IoDeleteSymbolicLink
IoDeleteDevice
InitSafeBootMode
IoCreateSymbolicLink
IoCreateDevice
MmUnmapLockedPages
_stricmp
ProbeForRead
RtlAnsiStringToUnicodeString
PsLookupProcessByProcessId
ZwReadFile
KeInitializeApc
KeInsertQueueApc
IoCreateFile
RtlInitAnsiString
RtlUnicodeStringToAnsiString
IoIs32bitProcess
MmProtectMdlSystemAddress
RtlEqualUnicodeString
IoFreeMdl
KeUnstackDetachProcess
RtlImageDirectoryEntryToData
ZwSetInformationFile
RtlFreeUnicodeString
ZwCreateFile
PsCreateSystemThread
MmMapLockedPagesSpecifyCache
PsTerminateSystemThread
ZwFreeVirtualMemory
RtlRandomEx
RtlAppendUnicodeStringToString
RtlFreeAnsiString
MmProbeAndLockPages
PsThreadType
RtlCompareMemory
MmUnlockPages
ZwQueryInformationProcess
ZwOpenFile
RtlImageNtHeader
ZwQueryInformationFile
ZwWriteFile
KeStackAttachProcess
IoAllocateMdl
ZwAllocateVirtualMemory
RtlGetVersion
ZwDeleteValueKey
ZwSetValueKey
ZwQueryValueKey
RtlCompareUnicodeString
ExAcquireResourceExclusiveLite
KeLeaveCriticalRegion
ExGetPreviousMode
MmGetSystemRoutineAddress
KeEnterCriticalRegion
ObQueryNameString
ExAcquireResourceSharedLite
IoGetCurrentProcess
ObfDereferenceObject
RtlPrefixUnicodeString
IofCompleteRequest
ZwDeviceIoControlFile
ObfReferenceObject
MmIsAddressValid
ObOpenObjectByPointer
CmRegisterCallbackEx
_vsnwprintf
CmUnRegisterCallback
KeDelayExecutionThread
KeQueryTimeIncrement
ProbeForWrite
PsGetProcessInheritedFromUniqueProcessId
ZwOpenProcess
PsGetProcessWow64Process
MmSystemRangeStart
wcsncpy
RtlSetDaclSecurityDescriptor
ExUnregisterCallback
IoRegisterShutdownNotification
ExRegisterCallback
ExCreateCallback
PsGetProcessCreateTimeQuadPart
MmUserProbeAddress
RtlCopyUnicodeString
KeResetEvent
KeBugCheckEx
PsGetCurrentThreadId
ObReferenceObjectByHandle
ZwClose
RtlInitUnicodeString
ObOpenObjectByName
ZwCreateKey
KeInitializeEvent
RtlAppendUnicodeToString
ExAcquireFastMutex
ExReleaseFastMutex
ExInitializeResourceLite
ExDeleteResourceLite
RtlHashUnicodeString
ZwQuerySystemInformation
ZwEnumerateValueKey
ZwEnumerateKey
ZwMapViewOfSection
ZwUnmapViewOfSection
ZwCreateSection
FsRtlIsNameInExpression
towupper
PsProcessType
IoGetTopLevelIrp
PsLookupThreadByThreadId
IoGetDeviceObjectPointer
ExRaiseStatus
KeAreApcsDisabled
_wcsnicmp
RtlQueryRegistryValues
IoVolumeDeviceToDosName
DbgPrint
PsIsThreadTerminating
RtlCompressBuffer
RtlDecompressBuffer
RtlGetCompressionWorkSpaceSize
RtlDeleteElementGenericTableAvl
RtlInsertElementGenericTableAvl
RtlInitializeGenericTableAvl
RtlLookupElementGenericTableAvl
FsRtlDissectName
ExFreePoolWithTag
ExReleaseResourceLite
ExAllocatePoolWithTag
__C_specific_handler
fltmgr.sys
FltDeletePushLock
FltGetFileNameInformationUnsafe
FltCloseClientPort
FltStartFiltering
FltRegisterFilter
FltBuildDefaultSecurityDescriptor
FltCloseCommunicationPort
FltUnregisterFilter
FltFreeSecurityDescriptor
FltCreateCommunicationPort
FltAcquirePushLockExclusive
FltInitializePushLock
FltReleasePushLock
FltAcquirePushLockShared
FltSendMessage
FltReleaseFileNameInformation
Sections
.text Size: 244KB - Virtual size: 243KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 15KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
INIT Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 808B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ